tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies (CVE-2026-49977) | HOL Guard CVE